Port Forwarding & Case Study

Transcription

1 Introduction This is to test the port forwarding on most of the routers supplied by TalkTalk. The case study looks at the wider picture, not just setting up port forwarding (in this case on a Huawei HG523A router), but also testing with applications, configuring of PC firewalls etc. Note: most routers do not allow Loop Back access so you will need to access the device only from an external network when using the external internet address. You will not be able to access the external IP address from the internal IP address, when the external address is port forwarded to another local device. Most routers prevent Loop Back as an additional security measure. The same goes for using a DDNS address to access the router from the internal network. If you have a Smartphone temporarily disable the WiFi and turn on Mobile Data, which will enable you to test access to the device via your mobile phone network. Basic order of work required 1. Add the port forwarding rule(s) to the router 2. Reboot the router 3. Add the required inbound rule(s) to the firewall 4. Launch the application 5. Test it locally from another device connected to your router's network (i.e. a device with a x address) 6. Test it with you will have to run it once for each port you are trying to use. and only go to step 7, if it reports ALL of the ports you have forwarded as OPEN. 7. Test using other people on the internet Sections in this document Case Study Test Setup FTP Server Settings FTP active & passive modes Other sections in the document:- Port forwarding on Huawei routers (not HG635) Windows 7 firewall settings Test Locally Test from Internet DDNS Port Forwarding to a port that is intercepted by the router Apple MACs running Windows applications Port Fowarding on other routers (all D-Link, HG633 & HG635) Universal Plug and Play (UPnP) Page 1 of 27 Date : 07/05/2015

2 Case Study This case study looks not only at port forwarding, but applications on the local PC that require the port forwarding, plus adding rules to the firewall that runs locally on that PC. It also deals with how to test this (crucially from the internet, as well as locally on your router's network). Test setup FTP server running on Windows 7 Home Premium (SP1) : FileZilla Server V FTP client running on Android V2.3.6 : FTPCafe FTP client Page 2 of 27 Date : 07/05/2015

3 FTP Server Settings Set up a User account &password plus a home directory. Active or Passive FTP mode The control of the FTP transfer is always done using TCP port 21, the port used to carry the data transfer varies on the FTP mode used. There are two modes used to transfer the data from the server to the client, active or passive mode. Active mode always uses TCP port 20 and the data transfer session is initiated by the server to the client. The client requests active mode by sending the PORT command to the server. It will tell the server to start a session to the IP address & TCP port, that it gives the server. This will therefore be initiated from the PC and will automatically be allowed through its firewall. It will still need some port forwarding for the traffic from the client to the server, but as it is a static port, this is not a problem. If the client on the other hand sends a PASV command to request passive mode, the server if it accepts this, will instruct the client to establish a new session to the required IP address & TCP port number. This port number is dynamically assigned & will be greater than This mode is regarded as more secure than active mode, but unless the router's port forwarding responded in a dynamic fashion, it will fail at this point. From my tests the HG523a will allow passive FTP mode transfers to pass through it correctly, even though the FTP-DATA session is initiated from the client over the internet. Page 3 of 27 Date : 07/05/2015

4 Router login To do this work, you will need to log in to your router. To do this browse to your router at:- At the prompt:- Enter your admin username & password. Unless you have changed this, the default is normally:- Username : admin password : admin Page 4 of 27 Date : 07/05/2015

5 Port Forwarding on Huawei routers (& some DSL-3780s) Log in to the router & go into advanced mode. From there go to:- Advanced > NAT > Port Mapping Either select an existing Application, or use the Customization option. In this case the FTP Server application can be used, but the IP address (maybe ) for the device hosting the FTP server will need to be added in the Internal host field:- If both external start & end ports are left at 21 this will work in passive mode OK. Page 5 of 27 Date : 07/05/2015

6 Note when adding this forwarding rule you will see this box:- Click OK to that. Click Submit & reboot the router. For all other routers, please see this section. Page 6 of 27 Date : 07/05/2015

7 Windows 7 Firewall settings Go to:- Create a new inbound rule:- Click Next in the above screen, then on this next screen browse to the program's executable file. In the case of the FileZilla Server, allow the server application (not the interface to the server):- Page 7 of 27 Date : 07/05/2015

8 Click Next, then on this screen tick Allow connection :- Then click next and on the next screen set as appropriate:- Page 8 of 27 Date : 07/05/2015

9 Click Next again, give it a unique name & click Complete :- It will now be displayed in the list of inbound rules under the name you allocated to it. Page 9 of 27 Date : 07/05/2015

10 Test Locally The next thing is to test that the client when connected to the same subnet can access the FTP Server on and download a file. If all is OK, then setup the port forwarding on the router. Page 10 of 27 Date : 07/05/2015

11 Testing from internet Note: when testing, you must have your server software running (e.g. FTP or Minecraft server software etc). Otherwise the port will always be closed. There is a website that can target your WAN IP address automatically & allow you to specify a port to check. It will report if it is open or closed. This should prove both your forwarding rule & your inbound rule within the firewall on your PC. This site is:- When you visit it from a device connected to your router (wired or wi-fi), it will populate the form with your router's WAN IP address & port 80. Change the port number to the one you want to test & click the "Check" button. The example below when the FTP server forwarding rule was working correctly:- Once that is OK finally test from a PC or phone that is not connected to your router's network (wired or wireless), but has access to the internet from another broadband connection or 3G or 4G Page 11 of 27 Date : 07/05/2015

12 etc. Page 12 of 27 Date : 07/05/2015

13 Note: most routers do not allow Loop Back access so you will need to access the device only from an external network when using the external internet address. You will not be able to access the external IP address from the internal IP address, when the external address is port forwarded to another local device. Most routers prevent Loop Back as an additional security measure. So if the device being forwarded to is and the device making the test is , this device will not be able to make a test to the router's WAN IP address. If you have a Smartphone temporarily disable the WiFi and turn on Mobile Data, which will enable you to test access to the device via your mobile phone network. Alternatively you could use a wireless hot spot. As far as this case study is concerned an FTP client called FTP Cafe was run on an Android phone via the 3G network. To test from a browser (if applicable) you must specify the port number e.g. port 81:- DDNS TalkTalk like most ISPs only offer static WAN IP addresses in their business packages & even then possible only as an extra option. DDNS however, gives you a static URL, which automatically updates itself with your new WAN IP address. This allows you to direct the client on the internet accessing your server software on local network via port forwarding, to target the DDNS URL, rather than your WAN IP address, which will change from time to time. For more details on DDNS, see this TalkTalk help page:- Testing via DDNS:- To test via DDNS originate a request from the internet (not from your local network {Loopback access will not work}). If you are using a browser to access an IP camera etc use your DDNS URL followed by colon (:) and the port number. The example below shows someone trying to access port 81 via DDNS:- If you are still having problems, ensure that the IP address used by the DDNS provider is correct. Page 13 of 27 Date : 07/05/2015

14 Port Forwarding to a port that is intercepted by the router If you have a PC at say which is hosting a webserver and you want to access this from the internet, normal port forwarding will fail. Your webserver is expecting an incoming connection on port 80. So you make your connection attempt from the internet to:- where a.b.c.d is the external or WAN IP address of the router. The router's management system is also a webserver, so your connection attempt (as it is targeting port 80), will be intercepted by the router's webserver. This is why you might see the router's login screen & your connection never reaches the web server on your PC. What you need to do is choose an unused TCP port number (maybe 8888), then create a new port forwarding rule and translate the external port 8888 to the internal port 80 (called PAT or Port Address Translation) and point this to the PC running the webserver. What you need is a rule like this:- Then from the internet try a browser connection to:- Page 14 of 27 Date : 07/05/2015

15 Apple MACs running Windows applications Apple MACs for sometime now have been able to run Windows applications via the Parallels Desktop software:- There are problems running certain Windows applications (e.g. Minecraft server), because these applications may not open the ports correctly when using Parallels. This will mean that port forwarding might not work, unless this is done correctly. Page 15 of 27 Date : 07/05/2015

16 Port Forwarding on other routers This will depend on the make & model of router that you have. The following are included in this guide. Once the PC firewall & port forwarding is all done, see the section on testing from the internet. 1. Huawei & some D-Link DSL-3780 variants (used in this case study) 2. D-Link DSL routers (not DSL-3780) 3. D-Link DSL-3780 variants with D-Link style interface 4. Huawei HG635 Super Router & possibly HG633 Page 16 of 27 Date : 07/05/2015

17 D-Link DSL routers (not DSL-3780) Log in to the router, then click on the Advanced tab at the top and Port Forwarding on the left:- Try leaving the Connection as PVC0 but this could need changing to PVC1. There is no need to make any firewall changes within the router. Once the changes are complete, click Apply & then Reboot on the left. Page 17 of 27 Date : 07/05/2015

18 D-Link DSL-3780 This is a bit of a weird router, in so much as some versions, once you get past the summary screens into "Advanced" mode have the Huawei "Look and feel" interface and some go into the more traditional D-Link interface. If your variant is of the "Huawei" interface and you should be able to follow my guidelines for Huawei routers. With this variant of the DSL-3780, you have to set up the port forwarding under Virtual Servers. There is also talk that you have to configure the Applications section as well, to open up the ports on the firewall of the router. However, recent tests have proved that if the Applications are configured, this makes the port forwarding operation very intermittent, often leaving the port closed when tested via various port testers such as First need to log in to the router. Page 18 of 27 Date : 07/05/2015

19 Virtual Servers Follow these instructions below taking particular notice of the interface option. This should not be left as WAN, but change it to PVC1. You can replace the Internal IP/port number with whatever ones you need. Click on the Advanced tab along the top and down the left hand side, click on Virtual Servers. The example below port forwards to an FTP server:- Add the required rule & click the Add/Apply button. Page 19 of 27 Date : 07/05/2015

20 Applications With the DSL-3780 you may also have to open up the ports on it's own firewall in addition to the firewall on the device you are attempting to forward these ports to. However, if configured, it can render the port forwarding operation to be very intermittent, with the port only showing Open occasionally. Therefore I do not recommend configuring this section at all. Router reboot If the router is rebooted at this point you may lose some of your settings, so go to:- Maintenance > System Settings > Save & reboot the device Click the Reboot button:- Page 20 of 27 Date : 07/05/2015

21 HG635 Super Router & possibly HG633 This is different to other routers, because instead of pointing it to an IP address, you point it to a known device which is identified by it's unique MAC address. First log in to the router. Select Internet from the tabs across the top and then select Port Forwarding. Expand Port Mapping and select New Port Mapping. There are to ways to do this, using a predefined application setting that will forward the necessary ports, or by adding a port mapping application, specifying the ports to forward yourself. Via an application 1. Enter a name for this rule in the Mapping Name field. 2. Choose your application from the Application dropdown box 3. Specify the PC, phone, tablet etc to forward to by selecting it from the Internal Host dropdown box:- Page 21 of 27 Date : 07/05/2015

22 Add a port mapping application If your application is not listed, in the Application dropdown box, you will need to know what ports that you have to forward for this to work. 1. Enter a name for this rule in the Mapping Name field (e.g. Test ). 2. Click Add a port mapping application To configure this follow this procedure. You will see this dialogue box presented to you Page 22 of 27 Date : 07/05/2015

23 The Name field will automatically be set to the name that you used for the Mapping Name field in the initial Port Mapping screen in step 1 above (e.g. Test ). Set the External port boxes to be the port number coming in from the internet that you want to forward on to your device. This will most likely be one port number, if so enter it in both boxes. If you have a consecutive range of ports e.g , then put 7700 in the first box & 7708 in the second. If you have a list of ports to forward that are not consecutive (perhaps 190, 375 & 3000) then create 3 totally separate rules for them. Repeat these for the internal ports unless you need to port translate as well:- The Protocol field requires a slight knowledge of the TCP/IP. All applications on a device (e.g PC, laptop, phone or tablet etc) have these ports associated with them. These applications sit in a layered approach above the IP address layer. In between them & the IP layer, are two protocols (TCP & UDP). Each port must go via TCP or UDP to get to the IP layer, it is these two protocols that need to be set in the Protocol field above. Application 1 (e.g. FTP) TCP IP addresses The options here are: TCP, UDP or TCP/UDP. Application 2 (e.g. Voice over IP client phone) The last option is used when some ports are allowed to use both TCP and UDP. However, if you are not 100% sure which protocol your ports use, then select TCP/UDP. Once this stage is complete, click the Save button. UDP Page 23 of 27 Date : 07/05/2015

24 Internal Host It does not matter now if you have configured the ports to forward by simply selecting one of the pre-defined applications from the Application dropdown box, or you have gone for the more complex Add port mapping application approach. This rule must now be pointed to the device connected locally to your router (wireless or wired). This is simply done by selecting the required device in the Internal Host dropdown box. So long as that device has connected previously to the HG635 router, it should be listed in there. If it is not listed in there, you will need to find out the MAC (Media Access Control nothing to do with Apple Mac products) address (see my blog on IP addresses & ports as this explains what a MAC address is). Once you know the MAC address, do not use the Internal Host dropdown box above, but click on the Add device link below the dropdown box. This is shown below:- Page 24 of 27 Date : 07/05/2015

25 Give it a meaningful name for the Device Name field e.g. MyLaptop Set the Device Type dropdown box to one of the following options:- Laptop computer Desktop computer Smartphone Tablet IP set top box IP camera IP phone Game machine Unrecognised device Finally click the Save button. Page 25 of 27 Date : 07/05/2015

26 Port Forwarding Summary Once all is done, you might see a summary page like this, but substituted with your applications:- Reboot the router Once all of the port mapping rules have been completed & saved, you must reboot the router. Page 26 of 27 Date : 07/05/2015

27 Universal Plug and Play UPnP means that a device can open the ports it needs as it wants to, and it can close them afterwards, nice and safe and very automatic. Port forwarding would only open those very same ports and keep them open even when the device was switched off, not as safe but will speed things up for that device as the router 'just knows' already (the entries in its routing table) what port/ip this traffic is destined for, whether the device is switched on and listening or not. Some devices allow the use of UpnP, this can be be enabled within the router. To do this log into the router and follow the brief guide below:- Huawei routers Advanced Mode > Advanced > UPnP D-Link routers Advanced mode > Advanced > Advanced LAN > UPnP D-Link DSL-3780 Advanced mode > Advanced > Network Tools > Network Tools - UPNP & DNLA > UPNP Settings Huawei HG635 Home Network > LAN Interface > Universal Plug and Play Page 27 of 27 Date : 07/05/2015